|
| 1 | +// Repo grants for GitHub start-reviewing go through native tenant HTTP, |
| 2 | +// never a SQL insert into Interchange grant/role tables. |
| 3 | +import { afterEach, beforeEach, describe, expect, test } from "bun:test"; |
| 4 | +import { configureSync, resetSync } from "@intx/log"; |
| 5 | +import type { ApiCall } from "@workbench/hub-client"; |
| 6 | + |
| 7 | +import { |
| 8 | + hasRepoGrantViaHttp, |
| 9 | + mintRepoGrantViaHttp, |
| 10 | +} from "./native-repo-grants"; |
| 11 | + |
| 12 | +let records: { properties: Record<string, unknown> }[]; |
| 13 | + |
| 14 | +function installCapturingSink(): void { |
| 15 | + records = []; |
| 16 | + configureSync({ |
| 17 | + reset: true, |
| 18 | + sinks: { |
| 19 | + capture: (record) => { |
| 20 | + records.push(record as { properties: Record<string, unknown> }); |
| 21 | + }, |
| 22 | + }, |
| 23 | + loggers: [ |
| 24 | + { category: ["errors"], sinks: ["capture"], lowestLevel: "debug" }, |
| 25 | + { category: ["logtape", "meta"], sinks: [], lowestLevel: "warning" }, |
| 26 | + ], |
| 27 | + }); |
| 28 | +} |
| 29 | + |
| 30 | +beforeEach(() => installCapturingSink()); |
| 31 | +afterEach(() => resetSync()); |
| 32 | + |
| 33 | +const REPO = { id: "1", name: "acme/widgets" }; |
| 34 | +const TENANT_ID = "tnt_bench"; |
| 35 | +const MEMBER_ROLE_ID = "rol_member"; |
| 36 | +const COOKIES = ["session=alice"]; |
| 37 | + |
| 38 | +function rolesPage() { |
| 39 | + return { |
| 40 | + data: [ |
| 41 | + { |
| 42 | + id: MEMBER_ROLE_ID, |
| 43 | + tenantId: TENANT_ID, |
| 44 | + name: "member", |
| 45 | + description: "System member role", |
| 46 | + isSystem: true, |
| 47 | + createdAt: "2026-01-01T00:00:00.000Z", |
| 48 | + updatedAt: "2026-01-01T00:00:00.000Z", |
| 49 | + }, |
| 50 | + ], |
| 51 | + nextCursor: null, |
| 52 | + }; |
| 53 | +} |
| 54 | + |
| 55 | +describe("mintRepoGrantViaHttp", () => { |
| 56 | + test("POSTs /api/tenants/:id/grants for repo:<name> read and never needs SQL", async () => { |
| 57 | + const posts: { |
| 58 | + path: string; |
| 59 | + body: unknown; |
| 60 | + cookies: string[] | undefined; |
| 61 | + }[] = []; |
| 62 | + const api: ApiCall = async (method, path, body, cookies) => { |
| 63 | + if ( |
| 64 | + method === "GET" && |
| 65 | + path.startsWith(`/api/tenants/${TENANT_ID}/roles`) |
| 66 | + ) { |
| 67 | + return { status: 200, data: rolesPage(), cookies: cookies ?? [] }; |
| 68 | + } |
| 69 | + if (method === "POST" && path === `/api/tenants/${TENANT_ID}/grants`) { |
| 70 | + posts.push({ path, body, cookies }); |
| 71 | + return { status: 201, data: { id: "grt_1" }, cookies: cookies ?? [] }; |
| 72 | + } |
| 73 | + throw new Error(`unexpected ${method} ${path}`); |
| 74 | + }; |
| 75 | + |
| 76 | + await mintRepoGrantViaHttp(api, TENANT_ID, REPO, COOKIES); |
| 77 | + |
| 78 | + expect(posts).toHaveLength(1); |
| 79 | + expect(posts[0]?.cookies).toEqual(COOKIES); |
| 80 | + expect(posts[0]?.body).toEqual({ |
| 81 | + roleId: MEMBER_ROLE_ID, |
| 82 | + resource: "repo:acme/widgets", |
| 83 | + action: "read", |
| 84 | + effect: "allow", |
| 85 | + origin: "creator", |
| 86 | + }); |
| 87 | + expect(records).toHaveLength(0); |
| 88 | + }); |
| 89 | + |
| 90 | + test("reports and rethrows when POST /grants is rejected", async () => { |
| 91 | + const api: ApiCall = async (method, path, _body, cookies) => { |
| 92 | + if ( |
| 93 | + method === "GET" && |
| 94 | + path.startsWith(`/api/tenants/${TENANT_ID}/roles`) |
| 95 | + ) { |
| 96 | + return { status: 200, data: rolesPage(), cookies: cookies ?? [] }; |
| 97 | + } |
| 98 | + if (method === "POST" && path === `/api/tenants/${TENANT_ID}/grants`) { |
| 99 | + return { |
| 100 | + status: 403, |
| 101 | + data: { error: { code: "forbidden", message: "nope" } }, |
| 102 | + cookies: cookies ?? [], |
| 103 | + }; |
| 104 | + } |
| 105 | + throw new Error(`unexpected ${method} ${path}`); |
| 106 | + }; |
| 107 | + |
| 108 | + await expect( |
| 109 | + mintRepoGrantViaHttp(api, TENANT_ID, REPO, COOKIES), |
| 110 | + ).rejects.toThrow( |
| 111 | + "POST /api/tenants/tnt_bench/grants failed with status 403", |
| 112 | + ); |
| 113 | + |
| 114 | + expect(records).toHaveLength(1); |
| 115 | + expect(records[0]?.properties).toEqual( |
| 116 | + expect.objectContaining({ |
| 117 | + operation: "mintRepoGrant", |
| 118 | + tenantId: TENANT_ID, |
| 119 | + extra: { repo: "acme/widgets" }, |
| 120 | + }), |
| 121 | + ); |
| 122 | + }); |
| 123 | +}); |
| 124 | + |
| 125 | +describe("hasRepoGrantViaHttp", () => { |
| 126 | + test("is true when GET /grants already lists repo:<name> read allow", async () => { |
| 127 | + const api: ApiCall = async (method, path, _body, cookies) => { |
| 128 | + if ( |
| 129 | + method === "GET" && |
| 130 | + path.startsWith(`/api/tenants/${TENANT_ID}/grants?resource=`) |
| 131 | + ) { |
| 132 | + return { |
| 133 | + status: 200, |
| 134 | + data: { |
| 135 | + data: [ |
| 136 | + { |
| 137 | + id: "grt_1", |
| 138 | + tenantId: TENANT_ID, |
| 139 | + roleId: MEMBER_ROLE_ID, |
| 140 | + roleName: "member", |
| 141 | + principalId: null, |
| 142 | + principalName: null, |
| 143 | + resource: "repo:acme/widgets", |
| 144 | + action: "read", |
| 145 | + effect: "allow", |
| 146 | + conditions: null, |
| 147 | + origin: "creator", |
| 148 | + expiresAt: null, |
| 149 | + createdAt: "2026-01-01T00:00:00.000Z", |
| 150 | + updatedAt: "2026-01-01T00:00:00.000Z", |
| 151 | + }, |
| 152 | + ], |
| 153 | + nextCursor: null, |
| 154 | + }, |
| 155 | + cookies: cookies ?? [], |
| 156 | + }; |
| 157 | + } |
| 158 | + throw new Error(`unexpected ${method} ${path}`); |
| 159 | + }; |
| 160 | + |
| 161 | + expect(await hasRepoGrantViaHttp(api, TENANT_ID, REPO, COOKIES)).toBe(true); |
| 162 | + }); |
| 163 | + |
| 164 | + test("is false when GET /grants lists no matching row", async () => { |
| 165 | + const api: ApiCall = async (method, path, _body, cookies) => { |
| 166 | + if ( |
| 167 | + method === "GET" && |
| 168 | + path.startsWith(`/api/tenants/${TENANT_ID}/grants`) |
| 169 | + ) { |
| 170 | + return { |
| 171 | + status: 200, |
| 172 | + data: { data: [], nextCursor: null }, |
| 173 | + cookies: cookies ?? [], |
| 174 | + }; |
| 175 | + } |
| 176 | + throw new Error(`unexpected ${method} ${path}`); |
| 177 | + }; |
| 178 | + |
| 179 | + expect(await hasRepoGrantViaHttp(api, TENANT_ID, REPO, COOKIES)).toBe( |
| 180 | + false, |
| 181 | + ); |
| 182 | + }); |
| 183 | +}); |
0 commit comments